Help our clients stay legal under “right to be forgotten,” Ernst & Young urges startups

Assuming Europe’s new General Data Protection Regulation passes its final hurdles later this year, it will provide several major headaches for web firms operating in the EU, with none being greater than the formalized “right to be forgotten.” This will be a bigger deal than the “right to be de-linked” that’s currently bothering Google and other search firms – it will give people the right to have information about themselves deleted, even if it is held by third parties.

Auditing and consulting giant [company]Ernst & Young[/company] (EY) knows this, and it has clients who are doubtless quaking in their boots – after all, in this world of platforms and APIs, who knows where their users’ data is, right? That’s why EY launched a data privacy startup challenge at London financial technology accelerator Level39 on Monday.

Advertisement

EY said it wanted to find six startups working on technologies around data capture, processing and erasure, that could help its clients deal with the incoming right. It said the regulation’s expected passage would raise consumer awareness around rights – with this on top of recent high-profile security breaches involving personal data, it said, businesses faced challenges “around reputation management, consumer trust, compliance, operational efficiency and ultimately growth.”

The startups will get mentoring and financial advice over a six-week period, along with “unprecedented access to EY clients and new potential customers.” One winner will also get the “opportunity” of getting an EY professional on board after the program, on secondment.

It remains to be seen whether the full-blown right to be forgotten will actually find its way into European law. The U.K. Lords recently urged that government to fight for its excision from the new regulation, on the basis that it’s unworkable. On the other hand, it may turn out that the messy beginnings of the closely-related right to be delinked will give way to a functioning system that allows people to protect their reputation without sliding into a censorship free-for-all.

It’s a bit too soon to tell, really. Whatever happens, clever wording in the finalized regulation could help make the new right both meaningful and workable, but technological solutions would also need to play a major role – as things stand, there is far too little oversight over where data goes online, to meaningfully protect people’s privacy rights. Which is, after all, the situation that the new law is trying to fix.

So I’m intrigued to see which startups EY will pick for its new program. If technology can help make personal data easier for the subjects to control without introducing new tools for surveillance and authoritarian control – the biggest risk here, in my opinion – then everyone’s a winner. That’s a big “if,” though.

Maybe I’m reading the article wrong, but I think you’re confusing two different motivations. I don’t see the search-engine delinking as being similar or even close to the right-to-be-forgotten initiative highlighted here.

The right-to-be-forgotten initiative under the General Data Protection Regulation focuses on data controllers, or online businesses that hold personal data. This data can be my name and email address, or shipping address, or credit-card details, or forum postings.

There are far too many sites that retain this data when you close your account with them. They claim legal liability as an argument for keeping, for example, your credit-card details or home shipping address for literally years after your last order with them.

If I want to sever my relationship with an online business, a data controller, then I should be able to do that and have all the personal details they collect and collate deleted too.

I would argue that there are clear similarities between the two initiatives, though I realise there are also clear differences (and certainly different legal underpinnings.) Both are about controlling one’s personal data online, albeit in different ways.